This example describes the PHP Web virus cleanup class. Share to everyone for your reference. Specifically as follows:
Believe that a lot of people's web pages are often unreasonable in the php,asp,html,js and other files in the background with some Trojan address, causing a lot of trouble! I used to have a station is this, so a hate to write this code, although the article has a little waste of resources, but always better than our manual
Analysis of Anti-virus detection and removal techniques of recent js scams
Recently, many netizens have reported that hackers have been blackmailed (also known as the "Locky ransomware"), and files, images, and other important information on computers have been encrypted by viruses. This type of virus carrier is a js script. The js script downloads the pe file of
. dll. scr. pif. com, overwrite the virus body content to the file header, so that the file is damaged and cannot be restored.
3. For other types of files, if the file size is smaller than the size of the virus file, the files will be overwritten, resulting in data repair failure.
Although the virus is extremely destructive, Internet users can download the late
, again banned crontab inside of things, ensure not automatically start;3. Execution: chmod 000/usr/bin/xxxxxxx chattr +i/usr/binThis command is a compound command that prohibits execution and then locks the/usr/bin so that the newly generated virus cannot be written inside.4, kill the main process, delete the virus subject.5, check the error, untie/usr/bin, remove the other viruses may be produced.Summari
" → "Search" → "file or folder" → "all files and folders" to maximize the window. Fill in "_ desktop" in the file name column. "ini", "more advanced options", select "search system folder", "search for hidden files and folders", and "Search subfolders", and click "Search ", after searching, click "edit" → select all, and then press Shift + Delete to Delete all the "_ desktop. INI file.
After the above processing, even if the system is restarted, the virus
first, how to find the virus
This virus has very obvious external characteristics, but it is often easy to ignore. It's easy to ignore because it doesn't slow down the computer, so many people don't notice it. However, if we double-click on the U disk, not open in the current window, but in a new window open, then it may be poisoned. At this point, you can right-click the letter in My computer, look at the
, without any setup, will automatically protect your system from intrusion and damage by the virus. Regardless of whether you have upgraded to the latest version, micro-point active defense can effectively clear the virus. If you do not upgrade the micro-point active defense software to the latest version, micro-point active defense software after the discovery of the v
The new QQ tail, the temptation to confuse netizens, click on the link in the message, download the operation will be in the recruit, after poisoning will continue to send similar messages to friends. The following are detailed analysis reports and manual removal methods:
Virus Name: worm.qqtaileks.ds.36864
Transmission mode: Send messages through QQ, and spread through automatic playback and malicious We
one delete.
5, enter the Registry Editor, the virus name for the keyword search, found after one by one delete. Focus on the [hk-loacal Machinesoftwaremicrosoftwindowscurrentversionrun] Branch, and the pane on the right will generally be visible as "C:windowsravmone.exe" or " C:windowsystem32svohost.exe "Such a virus startup entry, delete it.
6, in the Run dialog box type "Msconfig", enter after the Syst
Pigeon (Backdoor. huigezi) the author has not stopped the development of the gray pigeon. In addition, some people intentionally add different shells to the gray pigeon to avoid anti-virus software detection and removal, as a result, new gray pigeon variants are constantly emerging on the Internet. If your machine has symptoms of gray pigeon but cannot be found using anti-
uninstall program is false to confuse users!!
The Youth Forum Deadwoods netizen detailed analysis, because the original post picture has been invalidated, I will the content slightly edits to turn over:
Today Kaspersky report found Trojan Horse (December 19)
The latest version of Jinshan Poison PA and rising anti-virus software are not yet recognized this Trojan.
The following is installed on the machine with genuine rising on the characteristics of
exists. If the file does not exist, the virus is cleared.
Attachment: Spread of "MSN Booker" virus via "Facebook"
SkynetworkSecurityChannel News at noon on October 11, January 28, an MSN virus broke out on the internet and was named by rising as "MSN ".
In just a few hours, nearly a hundred users have asked rising for help. Chincomputer will send a
Your Web page is not often without reason in the Php,asp,html,js and other file backstage add some Trojan address it? I used to have a station like this, so a hate to write this code, although the article has a little waste of resources, but it is better than our manual removal, Let me tell you how to clean up the virus in the program.
First of all to read the $checkFile file This article is to determine w
About the Sxs.exe,autorun.inf virus removal method
Key words: Trojan.PSW.QQPa Autorun.inf
Reference:
Features: Sxs.exe,autorun.inf files are automatically generated in each packing directory, and some are generated SVOHOST.exe or sxs.exe under Windowssystem32, and the file attributes are implied attributes. Disable antivirus software automatically.
Transmission path: Mainly through the U disk, mobile ha
/* My program in foreign Srever, my own program to store where, I am very difficult to remember.
So made up a simple directory recursive function, view my program, very convenient.
*/
function tree ($directory)
{
$mydir =dir ($directory);
echo "
";
while ($file = $mydir->read ()) {
if (Is_dir ("$directory/$file") and ($file! = ".") and ($file! = "...")) {
echo "
$file";
Tree ("$directory/$file");
}else{
echo "
$file";
}
}
echo "
";
$mydir->close ();
}
Start the program
echo "
Cata
Your page is not often for no reason in the Php,asp,html,js and other files in the background plus some Trojans address it? I used to have a station is like this, so a hate to write this code, although the article has a little waste of resources, but always better than we manual removal is better, Let me talk about the principle of cleaning the virus in the program.
First of all to read $checkFile file Thi
Check out my sexy boobs:D Hey regarde mes tof!!:p ma soeur a voulu que t U regarde ca! Hey regarde les tof, c ' est moi et mes copains entrain de ...:D J ' ai Fais pour toi ce photo album Tu dois le Vo Ire:) tu dois voire ces tof mes photos chaudes:D C ' est seulement mes tof:p zijn enige mijn foto ' s br> wanna Hey ziet mijn nieuw fotoalbum? Indigde Enkel Nieuw fotoalbum!:) Hey keurt mijn nieuw fotoalbum goed.:p het voor yah, doend beeldverhaal van mijn leven lol ... en fotos!:p
Back door! I believe this word will not be unfamiliar to you, it's harm otherwise, but as people's awareness of security gradually enhanced, coupled with anti-virus software, "strong support" so that the traditional backdoor can not hide themselves, any little bit of computer knowledge, all know "check port" "Look at the process" in order to find some " Clues. " So, the writer of the back door adjusted the idea in time, focus on the dynamic link libra
About this explorer.exe virus. XP is now the most common virus, will consume a lot of system resources, resulting in a special computer lag.1, close the restore (assuming no, then skip), in order to prevent our changes, after the restore back again.2. Open the Registration form. Win + R key (or click Start-"Execute") then enter regedit and hit enter. This will allow you to open the registration form.3. In t
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.